New QR Code Scam Involves Unexpected Packages Showing Up at People’s Doors

A new QR code scam is making its way into people's homes, and it starts with something that may look completely harmless: an unexpected package.

You Have A Delivery

People have reported receiving packages they never ordered, addressed to them, with no clear explanation of where they came from. Inside, there may be a note claiming the item is a gift. The note can include a QR code and instructions to scan it to find out who sent the package or to learn how to return it.

That QR code is where the trouble can begin.

Getty Images

DO NOT SCAN THE QR CODE

Scammers can use QR codes to send people to fake websites designed to steal personal information. The website may ask for usernames, passwords, credit card numbers or other sensitive information.

In some cases, scanning a malicious QR code can also lead to malware being installed on a phone. That could potentially give scammers access to information stored on the device.

The scam is considered a new variation of a "brushing scam." Traditional brushing scams involve people receiving merchandise they never ordered, often as part of an attempt to create fake reviews or manipulate online shopping accounts.

What Should People Do?

Anyone who receives an unexpected package should be cautious, especially if it includes a QR code and instructions to scan it.

If you know the package is a legitimate gift, there is no need to scan the code to accept it.

People who have already scanned the QR code and entered a username or password should change that password immediately.

Getty Images

Also monitor bank accounts and credit card statements for unfamiliar transactions, and check credit reports for unrecognized accounts.

People concerned about identity theft can place a fraud alert or credit freeze on their credit reports. You can also report identity theft through IdentityTheft.gov, which provides steps for recovering from stolen personal information.

While the package may seem suspicious, federal law generally allows people to keep merchandise they did not order.

The safest response is to leave the QR code alone.